Mining procedure processing

Title Overview

1, Mining viruses generally have three parts , Daemon 、 Virus process 、crond Loop task , Just delete the three parts 
2, Generally, after the virus file is executed , Will delete the executable , No executable program was found , Here's the picture 

The abnormal process is as follows

The screening process

1, Get into /proc/pid/ perform ll command , see exe Corresponding executable program and cwd The path where the corresponding execution program is located
2, Get into /proc/pid/fd, perform ll command , see inode Information about , The following information is available

3, Find out /tmp/.X11-unix/11, Get into /tmp/.X11-unix Folder ,00 Files are daemons for virus programs pid,11 The process is a virus program pid
4, perform netstat Some problems will also be found

crond Loop task

1, perform crontab -l Discover timed tasks

2, Delete /var/spool/cron/root Under the rond command
3, Delete /root/.ucxin.sh file
4, Delete /etc/cron.d The sum of ucxin Related exception scripts

Be well protected

1, If you delete /root/.ucxin.sh file , It's in root Create .ucxin.sh Folder , And add permissions chattr +i .ucxin.sh
2, If /opt This script has also been deleted under , Also create a file with the same name , And set permissions
3,/tmp/.X11-unix/ Under the folder , Set file permissions setattr +i 00 setattr +i 11